Commitment to Security
Reliably and securely delivering the IT services our clients depend on is of paramount concern for our teams here at ScaleMatrix. As such, key aspects of our service delivery models have been carefully considered including:
Data Integrity
Services within the ScaleMatrix hybrid service catalog make use of industry standard encryption and authentication protocols such as Internet Protocol Security (IPsec), Secure Shell (SSH) and Multiprotocol Label Switching (MPLS) to ensure the integrity of data during transmission.
Access Control and Identity Verification
Authorized access to services, facilities, and critical platforms is controlled by the use of industry standard password and security policies, two factor authenticated access control systems, and biometric identity verification tools.
Uptime & Availability
ScaleMatrix hybrid services are provided from Tier 3 or better data centers located within the United States.
Overview
ScaleMatrix hybrid services make use of the following controls to ensure that the integrity of your data, access and identity management functions, and overall service availability meets current industry standards:
Physical Controls
These controls include: access control, fire prevention systems, environmental systems, cooling systems, exit routes, security personnel and data center surveillance monitoring.
Technical & Logical Controls
These controls include: firewalls, intrusion detection and prevention systems, threat management and mitigation controls, and encryption mechanisms.
Administrative Controls
These controls include: operational policy and procedures, security and escalation policies, log audits, vulnerability scanning and penetration testing.
Physical Controls
ScaleMatrix data centers are specifically designed to provide mission-critical reliability and continuity of service. Industry leading physical security features, including an armed security presence, and rigid physical controls policies help protect client assets and uninterrupted operations.
Each data center is audited annually to the SSAE-16 /ISAE SOC1 Type 2 and SOC2 Type 2 standards.
Physical Security Controls
Access to ScaleMatrix data centers is strictly regulated. All entrances are monitored by security personnel, in addition to two factor access control and utilize alarms for non-standard operations states. Data centers are staffed and patrolled by armed security officers to enhance physical security features and to provide protection for critical services housed within the data centers.
Digital Surveillance
Extensive use of digital security cameras monitor: all building entrance and egress areas, data center access points, all data center floor space where service equipment may be housed, and other areas designated and critical or sensitive.
Fire Suppression
ScaleMatrix facilities are protected by industry leading cabinet based fire suppression systems, minimizing the risk of collateral damage from an actual fire or false positive result. This risk mitigating platform provides significant improvements over traditional zone based suppression platforms.
Power & HVAC Systems
ScaleMatrix data centers are designed to meet high standards of redundancy. These include critical power and cooling platforms which are provisioned in a fault-tolerant, A+B configuration. Critical power load for each facility is supported by both redundant UPS systems and redundant emergency power generation systems.
Facilities Monitoring (FacMon)
In addition to the listed controls, ScaleMatrix data centers undergo consistent Facilities Monitoring (FacMon) reviews. Data from critical systems are sampled and charted to allow for historic reporting and trend analysis.
Technical & Logical Controls
Network Security
Industry-standard link encryption and authentication methods such as IPsec, SSH and MPLS are utilized to ensure the security of data during transmission. A multi-tiered set of defensive services are also used to strictly control network access to the data centers themselves.
Systems Security
Access services and platforms supporting the ScaleMatrix hybrid service catalog are strictly monitored. Servers and platforms are selected and configured to maximize their reliability and security, and are configured to prevent intrusions and protect against day‐to‐day threats.
Firewalls
Client data transfers may be made from the client’s environment to ScaleMatrix Data Centers via standard IPsec, SSH, MPLS or other direct network connection services. All non‐required firewall ports are blocked.
Intrusion Prevention Systems
ScaleMatrix utilizes enterprise-grade intrusion detection / intrusion prevention systems (IDS/IPS) to provide early detection of malicious activities.
Network and Security Monitoring
ScaleMatrix critical service platforms are managed by our distributed systems and security operations teams. System logs, as well as firewall and IDS/IPS event alerts are relayed and escalated 24/7/365 to facilitate early detection of any malicious events.
Administrative Controls
Access Control and Identity Verification
ScaleMatrix data center, business continuity, and business offices require escorted access. All physical access is tracked and recorded for security purposes. In addition, ScaleMatrix maintains biometric records of all personnel and clients who access system, service, and/or colocation equipment cabinets within ScaleMatrix facilities.
Personnel Security
All users with access to the ScaleMatrix hybrid service catalog are responsible for compliance with ScaleMatrix information security policies and standards. As part of the employment process, new employees undergo a screening process applicable per regional law. In the United States, personnel screening procedures include criminal background checks and drug screening. Each employee acknowledges Acceptable Use Policies in writing. Additional mechanisms for security awareness and education include articles in the corporate newsletters and periodic presentation seminars.
Communications and Operations Management
ScaleMatrix operates a centralized change management program, which includes testing, back out procedures, business impact analysis and management approval, where appropriate. Incident response procedures exist for security and data protection at specific ScaleMatrix designated infrastructure levels. The procedures include incident analysis, containment, response, remediation, reporting and procedures for returning to normal operations.
To minimize risk of malware infection, anti-malware software is used on all servers, as well as all desktop and notebook computers used by our personnel to connect to the ScaleMatrix network and service platforms.
Compliance with HIPAA, PCI-DSS, GLB
ScaleMatrix meets, exceeds, and can provide documentation around the necessary infrastructure-related controls to help clients meet HIPAA, PCI-DSS, and GLB compliance standards.
